{"id":"EM-20261104-1UKB","url":"https://cyber.eventmonitor.net/incident/EM-20261104-1UKB/apache-nms-activemq-vulnerability-cve-2026-103582/","type":"cve","title":"Apache NMS ActiveMQ Vulnerability (CVE-2026-103582)","subtitle":"CVE-2026-103582","subject":"CVE-2026-103582","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-04T11:17:13.637Z","firstSignal":"2026-11-04T10:16:45.000Z","lastSignal":"2026-11-04T11:17:13.637Z","updated":"2026-11-10T14:04:51.773Z","revision":1,"life":[{"status":"Born","at":"2026-11-04T11:17:13.637Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-04T11:17:13.637Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-04T10:16:45.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-04T11:17:13.637Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261104-1UKB created."},{"at":"2026-11-04T11:17:13.637Z","what":"Severity raised to High by C6"}],"stages":[{"name":"Disclosed","at":"2026-11-04T11:17:13.637Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T11:17:13.637Z","detail":"CVSS 7.5 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-04T10:16:45.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-04T10:16:45.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-103582 (moderate)","text":"Apache.NMS.ActiveMQ: Apache NMS ActiveMQ: Denial of Service via crafted OpenWire frames","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-103582.json"},{"at":"2026-11-04T11:17:13.637Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-103582 (CVSS 7.5)","text":"Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0.\n\n\n\nThe OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103582"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T11:17:13.637","score":7.5,"severity":"HIGH","desc":"Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0.\n\n\n\nThe OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum…","product":"","seen":1794319491773},"kev":null,"epss":{"epss":0.00216,"pct":0.1207,"at":1793926709349},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}